CompTIA SY0-701 Bundle

Stored XSS is the delivery of persistent attacker-controlled browser script through saved web content such as a comment or profile. The scenario describes executable bytes placed in a live trusted application's process memory. No web page, saved comment, HTML rendering, or browser execution is mentioned. A browser itself could be the victim process in a different case, but the attack technique here is cross-process memory manipulation, not unsafe storage and rendering of script content.

A buffer overflow overwrites bytes beyond the boundaries of an allocated buffer due to inadequate size validation. In this case the attacker deliberately places code inside a separate running process through process manipulation; there is no evidence of an overlong input or accidental out-of-bounds write. Buffer corruption might be one possible way to gain control in other scenarios, but it is not the described mechanism. The distinction is how the code enters the victim process.

A TOCTOU race exploits the time interval between checking a resource and using it after that resource changes. The case contains no temporary path, permission check, or resource replacement. The adversary's action is to inject executable bytes directly into a trusted process's memory, often followed by execution within that process. While concurrency vulnerabilities can sometimes help an attack, such a race is not part of the evidence provided and should not be presumed.

A vulnerable software dependency may contain a coding flaw that exposes applications consuming the package, even without an adversary intentionally modifying it. The scenario instead says the vendor's own build pipeline has been compromised and produces a malicious yet signed release. That is deliberate tampering with the software supply chain, not merely a library containing an unpatched bug. Users can receive a signed artifact through the expected channel even when dependency vulnerability scanning would not reveal its origin.

An operating-system vulnerability would be a defect in kernel or OS components that an attacker exploits to cross a protection boundary. The case focuses on malicious code introduced through a vendor build and signed-release process; no OS defect is specified. A compromised update might later exploit the OS, but the incident already exists at the software-delivery trust boundary. Labeling it as a kernel flaw would miss the integrity failure upstream of customer installation.

Firmware lifecycle exposure arises when a hardware device runs outdated or unmaintained low-level code and cannot receive needed security updates. The affected artifact here is described as a signed software release from a compromised vendor build pipeline, not an unpatchable router firmware image. Firmware can also be compromised through supply-chain attacks, but the defining case evidence is tampering before distribution, not support expiration. The narrowest diagnosis is the compromised release pipeline.

Software supply-chain compromise would mean an attacker modified source, dependencies, build tools, or distribution mechanisms before software reached the system. The question says an already installed device driver has an unpatched vulnerability that lets ordinary users obtain kernel privileges. The flaw is in how the operating system processes the driver's operations or permissions, not evidence that the vendor shipped a deliberately malicious release. The supported classification is privilege escalation through an OS-level component.

Firmware vulnerability refers to flaws in low-level code embedded in hardware devices, such as routers, controllers, or boot firmware, where update support may be limited. The item instead identifies a device driver executing under the operating system and a transition from an ordinary account to kernel privileges. A driver interacts with hardware, but it is still an OS-level component in this context. Firmware compromise or firmware update limitations are not established by the stated behavior.

End-of-life exposure means a product has passed the point when the manufacturer provides security fixes or official support. The driver is unpatched in this case, but the stem does not say the vendor discontinued maintenance; a suitable update may simply not have been applied. An unpatched flaw and a permanently unsupported product are related yet distinct conditions. Without a stated support deadline, classifying the driver primarily as end-of-life would be an unjustified lifecycle assumption.

An OS-level vulnerability involves privileged operating-system code such as a kernel subsystem or driver, allowing a protection boundary to be crossed. The affected router here runs outdated firmware and lacks a safe vendor update mechanism, so the problematic code resides in embedded device firmware rather than an identifiable workstation OS service. Routers do run operating systems internally, but the question emphasizes the firmware lifecycle and remediation limitations that are most relevant to this device.

A vulnerable third-party software dependency is an external library or package that an application consumes, creating exposure through its application or build pipeline. No external package, application manifest, or dependency resolution is mentioned in this router case. The defect concerns a device's installed firmware image and lack of a supported update path. General software-component scanning could still help identify flaws, but it would not by itself provide a secure firmware patch mechanism.

End-of-life exposure specifically means manufacturer support or security maintenance has formally ended. The router's firmware is outdated and the vendor offers no patch mechanism, but the stem does not explicitly say the entire model is discontinued or beyond its support date. Lack of an upgrade path is serious and can coexist with end of life; however, the tested fact is the embedded firmware and its technical maintenance limitation. Do not infer an announced lifecycle termination not actually given.

Firmware vulnerabilities may involve defects in low-level device software or unsafe firmware update processes, including unsigned images or a missing upgrade path. The storage controller could suffer such flaws, but the scenario does not identify a particular firmware exploit. It explicitly says the manufacturer no longer provides security fixes for this critical product. The support cutoff is the distinguishing issue and may affect hardware as well as firmware; the broad category is end-of-life exposure.

A zero-day vulnerability is a security flaw unknown to or unpatched by the defender at discovery, often before a vendor has a fix. The scenario identifies a manufacturer's decision to end security fixes, not evidence that an attacker discovered a previously unknown exploit. Unsupported products may accumulate known vulnerabilities as well as new ones. Calling every unpatched end-of-life flaw a zero-day incorrectly conflates vendor lifecycle status with when vulnerability information became available.

A vulnerable software dependency is a faulty external library or package on which an application relies. Nothing in the storage-controller scenario points to dependency versions or untrusted package publication. Instead the hardware vendor has ended security maintenance for the whole critical controller. Even if the controller contains third-party components, the decisive risk is loss of manufacturer support and a reliable patch path. Treating the condition as a single application dependency would obscure that wider lifecycle constraint.

Cloud metadata exposure through SSRF happens when an application can be tricked into making server-side requests to an instance metadata endpoint, potentially disclosing temporary credentials. The case describes guest code reaching the hypervisor boundary, not a web server accepting a forged URL or returning metadata credentials. Both may expose cloud resources, but one crosses virtualization isolation directly and the other abuses an application request primitive. The stated behavior is virtual-machine escape rather than a metadata-service request.

Cloud permissions misconfiguration occurs when a resource policy, identity role, or access grant allows more operations than intended, such as public reads of a storage bucket. The malicious code here does not simply use an overly broad permitted cloud role; it accesses hypervisor resources outside the guest's assigned virtual boundary. A cloud administrator could also misconfigure isolation, but no incorrect policy grant is described. The important symptom is failure of hypervisor/guest separation, not an overprivileged API credential.

Resource reuse isolation failure occurs when data from one tenant remains accessible after resources such as storage blocks are reassigned to another. The guest code in this scenario reaches active hypervisor resources beyond its sandbox, with no storage reallocation or residual previous-tenant data. Both are virtualization-isolation problems, but the object and stage differ. Access outside a running guest's boundary is VM escape, whereas exposure from uncleared reused media is a separate data-remanence mechanism.

VM escape occurs when code running inside a guest crosses into the hypervisor or an unauthorized host context. The incident happens when the provider reallocates a volume and fails to clear the former tenant's bytes; no guest escapes its execution boundary. The new tenant may only be using normal block reads, but those reads expose another customer's residual data because of a sanitation failure. The specific defect is isolation at resource reuse, not execution outside a virtual machine.

Cloud permissions misconfiguration would grant a person or workload an overly broad role, public bucket access, or unauthorized operation through a policy. Here the new tenant is legitimately assigned a storage volume, but the provider has not sanitized the bytes left by the prior tenant. The identity permissions might be perfectly configured for the new allocation; the exposure arises because old data remains on the reused resource. Altering access-control grants alone would not remove residual blocks.

End-of-life exposure occurs when a storage controller or software product no longer receives supported security fixes. No support deadline or obsolete hardware is mentioned in this incident. The immediate issue is the cloud provider's failure to wipe or cryptographically isolate a volume before reuse. Even a brand-new supported platform can mishandle data sanitization. The scenario therefore points to a reuse-control defect rather than loss of vendor maintenance.

Cloud metadata exposure through SSRF requires a server-side request flaw that reaches an instance metadata endpoint or another internal resource. This case instead describes an object-storage bucket whose policy directly allows anonymous reads. No application proxy, forged URL, or metadata credentials are used. Although metadata theft can lead to unauthorized cloud access in other incidents, the available evidence concerns a misconfigured resource permission, not an SSRF request path.

Configuration exposure is a broad description of unintentionally open or insecure settings. It is factually related to a public cloud storage bucket, but the question asks for the most specific class of vulnerability. The exact defect is an identity or resource policy permitting anonymous read access to confidential objects. Stating only configuration exposure fails to identify which access decision was misconfigured and why unauthorized readers can retrieve data.

Resource reuse isolation failure involves information left on storage blocks or other shared resources after they are reassigned between tenants. The storage in this question is still being served from an active bucket under an access policy that permits public reads; there is no prior tenant or unsanitized allocation. The attacker's access is granted by a faulty authorization rule rather than by discovering remnant data in a newly allocated volume.

Directory traversal exploits manipulation of filesystem path components to read files outside the application's intended directory. The reported behavior instead causes a server-side HTTP request to a metadata service; no local path traversal or file read is involved. A server might have both weaknesses, but the input crosses a network-request boundary here rather than a filesystem directory boundary. File path canonicalization would not by itself prevent access to an internal HTTP metadata endpoint.

Cloud permissions misconfiguration refers to excessive rights granted through roles or resource policies. The case establishes that an application can be coerced into requesting metadata credentials through SSRF; it does not say the underlying role's permissions are broader than intended. Overprivileged credentials could increase the consequences if stolen, but the immediate vulnerability is the server-side request capability. Improving authorization scoping is defense in depth, not a replacement for fixing the SSRF entry point.

Unsafe deserialization would arise from treating untrusted serialized objects as executable or privileged application structures. The example describes a user-controlled server-side request directed at instance metadata, not object deserialization, class instantiation, or gadget invocation. Both bugs can result in serious compromise, but their execution primitives differ. Selecting deserialization would require evidence that crafted serialized data triggers code behavior rather than evidence that a URL can reach an internal service.

A password-hashing work factor governs the cost of testing guessed passwords against stored verifiers, helping slow offline attacks. The scenario instead involves authenticated encryption of different messages with the same key and nonce. Password-verifier configuration does not determine whether an AEAD algorithm has received distinct nonces, and there is no password database in the case. The failure is in encryption invocation requirements, not password derivation strength.

An expired TLS certificate can cause clients to reject the server's asserted identity even if the underlying cipher remains technically sound. The case makes no claim about certificates, certificate validity periods, or TLS server authentication. It describes repeated nonces under one authenticated-encryption key. Certificate renewal would not repair cryptographic misuse during symmetric encryption, and changing server trust status would not guarantee correct nonce generation.

Digital signatures can authenticate a software publisher and help recipients detect alterations in a distributed package. The scenario does not concern software provenance or any separate release artifact. It deals with nonce values supplied repeatedly to an authenticated-encryption operation. Adding a software signature elsewhere cannot restore confidentiality or authenticity guarantees compromised by nonce reuse within the encryption service. The relevant fix must address nonce/key management directly.

End-of-life exposure arises when the device or application is no longer maintained and therefore cannot receive ordinary security fixes. The staff in this case install unsigned tools from unknown links, but no vendor support cutoff is stated. A current, fully supported phone can be compromised by untrusted app installation without being obsolete. The immediate policy failure is bypassing approved distribution and provenance checks, not the end of a product's maintenance lifecycle.

A vulnerable software dependency is a third-party library or package with a known flaw incorporated into an application or build. The scenario does not identify any dependency version or exploit in the code being installed. Its explicit facts concern unknown download sources, unsigned packages, and avoidance of the organization's approved app store. Dependency scanning is useful after software is obtained, but it does not establish provenance or replace control over where staff may install mobile apps.

Jailbreaking removes platform restrictions and can grant unusually privileged access to applications or users. The scenario does not report that anyone altered the mobile operating system or removed enforcement mechanisms at the system level. It only describes installing tools from unapproved links, which some devices permit through ordinary settings. Jailbreaking may increase sideloading risk, but sideloading alone does not prove that platform security restrictions were removed or that root privileges were obtained.